workflows: set default read contents for workflows

.github/workflows/build-for-pr.yml

@@ -9,6 +9,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 env:
   TERM: xterm
 

.github/workflows/ci.yaml

@@ -6,6 +6,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 env:
   TERM: xterm
 

.github/workflows/compatibility-matrix-testing.yml

@@ -11,6 +11,9 @@ on:
         description: "The desktop version to test"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   ## This is picked up after the finish for cleanup
   upload-cmt-server-detals:

.github/workflows/e2e-functional-template.yml

@@ -114,6 +114,9 @@ on:
         type: string
         required: true
 
+permissions:
+  contents: read
+
 env:
   AWS_S3_BUCKET: "mattermost-cypress-report"
   BRANCH: ${{ github.head_ref || github.ref_name }}

.github/workflows/e2e-functional.yml

@@ -29,6 +29,9 @@ on:
         required: false
         default: false
 
+permissions:
+  contents: read
+
 jobs:
   prepare-matrix:
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.instance_details != '' }}

.github/workflows/nightly-builds.yaml

@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: 0 4 * * 0-5
 
+permissions:
+  contents: read
+
 jobs:
   tag-nightly-build:
     runs-on: ubuntu-22.04

.github/workflows/nightly-main.yml

@@ -23,6 +23,9 @@ env:
   MM_WIN_INSTALLERS: 1
   REFERENCE: ${{ inputs.tag }}
 
+permissions:
+  contents: read
+
 jobs:
   build-linux:
     runs-on: ubuntu-22.04

.github/workflows/nightly-rainforest.yml

@@ -18,6 +18,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 env:
   TERM: xterm
   MM_DESKTOP_BUILD_DISABLEGPU: true

.github/workflows/release-mas.yaml

@@ -10,6 +10,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 env:
   TERM: xterm
 

.github/workflows/release.yaml

@@ -10,6 +10,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 env:
   TERM: xterm
   MM_WIN_INSTALLERS: 1

.github/workflows/run-release-script.yml

@@ -27,6 +27,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 env:
   TERM: xterm
 

.github/workflows/snyk-sbom.yml

@@ -9,6 +9,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   sbom:
     permissions: